1. The Field of the Invention
The present invention relates generally to high-speed data capture and analysis. More specifically, the present invention relates to timestamping of captured data for analysis and troubleshooting.
2. The Relevant Technology
Data communication systems typically use a variety of different data transmission mechanisms to enable communication between and among associated subsystems. Each transmission mechanism is associated with a particular transmission, or communication, protocol that defines various parameters concerning the transmission of data in connection with the transmission mechanism. Such communication protocols commonly specify, for example, the manner in which data is encoded onto a transmission signal, the particular physical transmission media to be used with the transmission mechanism, link layers, and other attributes concerning the transmission environment.
As data moves from a point of origin to a destination by way of communication links, the data passes through a variety of devices collectively representing multiple protocols and types of hardware. Typically, each device modifies the data so that the data can be transmitted by way of a particular communication link. However, modification of the data in this manner often causes errors or other problems with the data. Such errors may occur as the result of various other processes and conditions in the mechanisms as well. Moreover, data errors and other problems present at one location in the data stream can cause additional errors or other problems to occur at other locations in the data stream and/or at other points in the communications system and associated links.
One approach to problem identification, analysis, and resolution in communications systems involves capturing a portion of the data communicated in a link for review and analysis. As used herein, “communications link” can also refer to data transfer links, network links, optical links, copper links, wireless links, etc. In some cases, such data capture is performed in connection with a network analyzer. A network analyzer can include various hardware and software elements configured to capture data from one or more communications links in the communications system, and present the captured data in various formats to a user or technician by way of a graphical user interface or other device.
Generally, such network analyzers capture data traffic in the communications system over a defined period of time, or in connection with the occurrence of predefined events. Use of an analyzer can allow a network administrator to track the progress of selected data as that data moves across the various links in the communication system. Corrupted or altered data can then be identified and traced to the problem link(s), or other parts of the communications system.
Captured data is often tracked in time using timestamps. Timestamps are time dependant records, signals, or values that can be associated with the data records as the data records are received at a particular location within the capture and analysis system. Depending on the type of system, data records and other portions of the data stream can also be referred to as packet, signal, word, frame, block, cell, segment, etc. Timestamps can be assigned to particular data records at predetermined intervals as the data records are received by the analyzer. In some instances, the timestamps can be interleaved with the data records and can be stored in the analyzer's memory buffer along with the captured data. The stored timestamps can later be used to identify when the data passed the certain location in the capture and analysis system. Timestamps are also important for producing an accurate time dependant depiction of the network activity for presentation to a user.
Measuring the time between data records received (word time) may actually be a useful measurement to make. However, the measurement of an acceptably accurate word time has not been implemented because a conventional clock used with an analyzer is typically not precise enough in certain high-speed applications (e.g. 10 Gbps). As a result, accuracy is limited by the number of data records captured between the timestamps and by the precision of the clock.
Instead, timestamp records are often interleaved with the captured data records and spaced between multiple captured records at predetermined intervals. For example, timestamp records can be interleaved with the captured data records by inserting a timestamp record at intervals of 128 data records or 2048 data records. To determine when the data that is intermediate to the timestamps was received, a “theoretical” word time can be used. A theoretical word time is an estimate of the actual time between data records received. Thus, where a data record being examined was received 50 data records after a first timestamp, an amount of time equal to 49 data records worth of time (i.e. 49 multiplied by the theoretical word time) can be added to the first timestamp value to get the theoretical arrival time of that 50th data record.
One problem encountered with this method of timestamp calculation is that the rate at which a network communication system transmits data is not entirely constant. Many factors can affect the rate at which data is transferred. This is especially so with high speed data transfer systems and small increments of timestamp precision. Even small changes in transfer rate can create problems when tracking data captured at high rates of speed (e.g. 1-10 Gbps). In some instances actual word time on a wire can vary around the ideal word time by approximately 100 parts per million.
The above described technique for tracking data in time can cause problems where the real time capture rate is less than expected, and the calculated timestamps assigned to the intervening data records overlaps a second actual timestamp record. For example, consider a system inserting actual timestamp records every 128 captured data records where the 127th captured data record is associated with a calculated timestamp record of 126 theoretical word time values added to the previous actual timestamp record. If the following actual timestamp record (i.e. the 128th timestamp record) is clocked into memory an instant before the 127th calculated timestamp record is about to increment, then that 128th timestamp record would be lower than the calculated timestamp record assigned to the 127th captured record. As a result, the 128th captured data record is associated with an actual timestamp record having an earlier timestamp value than the calculated timestamp value associated with the 127th data record. This can be referred to as “a negative delta time”. Negative delta time causes problems in modeling, presenting, and tracking the captured data. Even an overlap of 5 nanoseconds can create several problems in high speed data capture and analysis systems.
To work around these issues, conservative “hard coded” word times have been used (for example 2.7 nanoseconds in a 10 Gbps system). This underestimated conservative word time guarantees that all timestamps increase monotonically with the existing source code. The disadvantage to this approach is that, when viewing data with the analyzer, each data record appears to be clocked in slightly faster than it should have. Also, small gaps in time show up on a regular basis, which are required to keep synchronized with the real-time values of the actual timestamps.
A conservative word time prevents the negative delta time problem. Even still, in these instances the accuracy at which the timestamps are associated with the data records is not ideal. In addition, the small gaps in time that appear from this method of tracking data may confuse a user because the gap in time depicted is merely an artifact created by the shift from a calculated timestamp value (based on a conservative word time) to an actual timestamp value (based on a hardware clock signal). These gaps can cause data to appear skewed when comparing data across multiple channels.
Thus, what would be advantageous are methods and apparatuses for accurately tracking data received by a data capture and analysis system in time.